3 ms·
Couldn't this be solved by signing the update file? But the excuse of the dev is bogus in any case. In is trivial to have that single file transferred via HTTP
by teilo 10y ago
Couldn't this be solved by signing the update file?
But the excuse of the dev is bogus in any case. In is trivial to have that single file transferred via HTTPS. His ad revenue excuse makes me thing something fishy is going on here.
- bqe 10y agoThat would help, but an attacker being able to deliver an arbitrary website by MITM is still something that should be avoided.
- stcredzero 10y agoSigning the update file and having a separate page for the SHA256 hash of the binary would win back a lot of my confidence at this point.